2020-05-05T01:09:16.791892shield sshd\[10858\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.82.75.58.static.user.ono.com  user=root
2020-05-05T01:09:18.221940shield sshd\[10858\]: Failed password for root from 62.82.75.58 port 16613 ssh2
2020-05-05T01:10:04.942304shield sshd\[11176\]: Invalid user deep from 62.82.75.58 port 10410
2020-05-05T01:10:04.946229shield sshd\[11176\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=62.82.75.58.static.user.ono.com
2020-05-05T01:10:06.631101shield sshd\[11176\]: Failed password for invalid user deep from 62.82.75.58 port 10410 ssh2

May  5 03:35:28 inter-technics sshd[20097]: Invalid user admin from 61.178.143.19 port 44790
May  5 03:35:28 inter-technics sshd[20097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.178.143.19
May  5 03:35:28 inter-technics sshd[20097]: Invalid user admin from 61.178.143.19 port 44790
May  5 03:35:30 inter-technics sshd[20097]: Failed password for invalid user admin from 61.178.143.19 port 44790 ssh2
May  5 03:40:16 inter-technics sshd[22584]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=61.178.143.19  user=root
May  5 03:40:18 inter-technics sshd[22584]: Failed password for root from 61.178.143.19 port 54726 ssh2
...

May  4 22:32:54 NPSTNNYC01T sshd[5624]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=210.115.225.135
May  4 22:32:56 NPSTNNYC01T sshd[5624]: Failed password for invalid user css from 210.115.225.135 port 44327 ssh2
May  4 22:37:33 NPSTNNYC01T sshd[6001]: Failed password for root from 210.115.225.135 port 49185 ssh2
...

firewall-block, port(s): 81/tcp

May  5 05:44:17 vps sshd[760125]: Failed password for root from 222.186.30.218 port 17112 ssh2
May  5 05:44:19 vps sshd[760125]: Failed password for root from 222.186.30.218 port 17112 ssh2
May  5 05:51:33 vps sshd[799956]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.30.218  user=root
May  5 05:51:35 vps sshd[799956]: Failed password for root from 222.186.30.218 port 12502 ssh2
May  5 05:51:37 vps sshd[799956]: Failed password for root from 222.186.30.218 port 12502 ssh2
...

May  5 01:43:14 IngegnereFirenze sshd[3764]: Failed password for invalid user richard from 122.51.189.69 port 36056 ssh2
...

05.05.2020 03:57:21 SSH access blocked by firewall

[2020-05-04 23:36:57] NOTICE[1157] chan_sip.c: Registration from '' failed for '185.147.215.14:63369' - Wrong password
[2020-05-04 23:36:57] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-04T23:36:57.204-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="63",SessionID="0x7f5f100266a8",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.215.14/63369",Challenge="012dbbe3",ReceivedChallenge="012dbbe3",ReceivedHash="b4344640c32ba71a362a10aaf79fd8da"
[2020-05-04 23:37:10] NOTICE[1157] chan_sip.c: Registration from '' failed for '185.147.215.14:56328' - Wrong password
[2020-05-04 23:37:10] SECURITY[1173] res_security_log.c: SecurityEvent="InvalidPassword",EventTV="2020-05-04T23:37:10.080-0400",Severity="Error",Service="SIP",EventVersion="2",AccountID="63",SessionID="0x7f5f1001be58",LocalAddress="IPV4/UDP/192.168.244.6/5060",RemoteAddress="IPV4/UDP/185.147.215.14/563
...

May  5 05:13:17 vps sshd[517722]: Invalid user coc from 92.222.134.51 port 60410
May  5 05:13:17 vps sshd[517722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.134.51
May  5 05:13:19 vps sshd[517722]: Failed password for invalid user coc from 92.222.134.51 port 60410 ssh2
May  5 05:17:24 vps sshd[540745]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.222.134.51  user=root
May  5 05:17:26 vps sshd[540745]: Failed password for root from 92.222.134.51 port 42904 ssh2
...

Observed on multiple hosts.

May  4 22:10:37 vps46666688 sshd[27860]: Failed password for invalid user admin from 157.157.87.22 port 34218 ssh2
May  4 22:10:40 vps46666688 sshd[27860]: Failed password for invalid user admin from 157.157.87.22 port 34218 ssh2
May  4 22:10:40 vps46666688 sshd[27860]: error: maximum authentication attempts exceeded for invalid user admin from 157.157.87.22 port 34218 ssh2 [preauth]
...

3389/tcp 1723/tcp 3128/tcp...
[2020-03-12/05-05]25pkt,4pt.(tcp),1pt.(udp)

May  5 03:09:50 server dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=2a02:a03f:3e3b:d900:f1e4:c0fc:50a:cf9, lip=2a01:7e01:e001:164::, session=
May  5 03:09:57 server dovecot: imap-login: Aborted login (auth failed, 1 attempts in 7 secs): user=, method=PLAIN, rip=2a02:a03f:3e3b:d900:f1e4:c0fc:50a:cf9, lip=2a01:7e01:e001:164::, session=
May  5 03:09:57 server dovecot: imap-login: Aborted login (auth failed, 1 attempts in 7 secs): user=, method=PLAIN, rip=2a02:a03f:3e3b:d900:f1e4:c0fc:50a:cf9, lip=2a01:7e01:e001:164::, session=
May  5 03:10:05 server dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=, method=PLAIN, rip=2a02:a03f:3e3b:d900:f1e4:c0fc:50a:cf9, lip=2a01:7e01:e001:164::, session=

...

Unauthorized connection attempt detected from IP address 198.108.66.112 to port 465 [T]

firewall-block, port(s): 21/tcp, 6346/tcp